@stacksjs/env 0.70.187 → 0.70.189

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -1,26 +1,26 @@
1
1
  // @bun
2
- import{createCipheriv as e,createDecipheriv as ff,createHash as d,createPrivateKey as Ef,createPublicKey as gf,diffieHellman as Bf,generateKeyPairSync as $f,hkdfSync as Af,randomBytes as u}from"crypto";var r="x25519-public:",t="x25519-private:",c="encrypted:v2:",y="encrypted:",_f=Buffer.from("stacks-env:v2","utf8"),Xf="Environment decryption failed: authentication or format error";function Df(f){if(f.length===32)return f;return d("sha256").update(f).digest()}function pf(f,g){let B=u(16),A=e("aes-256-gcm",Df(g),B);return{ciphertext:Buffer.concat([A.update(f,"utf8"),A.final()]).toString("hex"),iv:B.toString("hex"),authTag:A.getAuthTag().toString("hex")}}function qf(f,g,B,A){try{let $=ff("aes-256-gcm",Df(g),Buffer.from(B,"hex"));return $.setAuthTag(Buffer.from(A,"hex")),Buffer.concat([$.update(Buffer.from(f,"hex")),$.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function z(f){return f.toString("base64url")}function C(f,g,B){if(typeof f!=="string"||f.length>0&&!/^[A-Za-z0-9_-]+$/.test(f))throw Error(`${g} is not canonical base64url`);let A=Buffer.from(f,"base64url");if(z(A)!==f)throw Error(`${g} is not canonical base64url`);if(B!==void 0&&A.length!==B)throw Error(`${g} has an invalid length`);return A}function Lf(f){if(!f.startsWith(r))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let g=gf({key:C(f.slice(r.length),"public key"),format:"der",type:"spki"});if(g.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return g}function xf(f){if(!f.startsWith(t))throw Error("Private key is not a version 2 X25519 key");let g=Ef({key:C(f.slice(t.length),"private key"),format:"der",type:"pkcs8"});if(g.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return g}function Hf(f){return Buffer.from(`stacks-env:v2;${f.epk};${f.salt};${f.nonce}`,"utf8")}function F(){let{publicKey:f,privateKey:g}=$f("x25519"),B=f.export({format:"der",type:"spki"}),A=g.export({format:"der",type:"pkcs8"});return{publicKey:`${r}${z(B)}`,privateKey:`${t}${z(A)}`}}function P(f,g){let B=Lf(g),A=$f("x25519"),$=z(A.publicKey.export({format:"der",type:"spki"})),_=u(16),D=u(12),O=Bf({privateKey:A.privateKey,publicKey:B}),R=Buffer.from(Af("sha256",O,_,_f,32)),X={epk:$,salt:z(_),nonce:z(D)};try{let H=e("aes-256-gcm",R,D);H.setAAD(Hf(X));let W=Buffer.concat([H.update(f,"utf8"),H.final()]),G={v:2,...X,ciphertext:z(W),tag:z(H.getAuthTag())};return`${c}${z(Buffer.from(JSON.stringify(G),"utf8"))}`}finally{O.fill(0),R.fill(0)}}function Mf(f){let g=C(f.slice(c.length),"envelope").toString("utf8"),B=JSON.parse(g);if(!B||typeof B!=="object"||Array.isArray(B))throw Error("envelope is not an object");let A=Object.keys(B).sort(),$=["ciphertext","epk","nonce","salt","tag","v"];if(A.length!==$.length||A.some((_,D)=>_!==$[D]))throw Error("envelope fields are invalid");if(B.v!==2)throw Error("envelope version is unsupported");for(let _ of["epk","salt","nonce","ciphertext","tag"])if(typeof B[_]!=="string")throw Error(`${_} is invalid`);return B}function zf(f,g){try{let B=Mf(f),A=xf(g),$=gf({key:C(B.epk,"ephemeral public key"),format:"der",type:"spki"});if($.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let _=C(B.salt,"salt",16),D=C(B.nonce,"nonce",12),O=C(B.ciphertext,"ciphertext"),R=C(B.tag,"tag",16),X=Bf({privateKey:A,publicKey:$}),H=Buffer.from(Af("sha256",X,_,_f,32));try{let W=ff("aes-256-gcm",H,D);return W.setAAD(Hf(B)),W.setAuthTag(R),Buffer.concat([W.update(O),W.final()]).toString("utf8")}finally{X.fill(0),H.fill(0)}}catch{throw Error(Xf)}}function Vf(f,g){try{if(!/^[0-9a-f]{64}$/.test(g))throw Error("invalid legacy private key");let B=Buffer.from(f.slice(y.length),"base64");if(B.length<32)throw Error("invalid legacy payload");let A=d("sha256").update(Buffer.from(g,"hex")).digest(),$=d("sha256").update(A).digest();return qf(B.subarray(32).toString("hex"),$,B.subarray(0,16).toString("hex"),B.subarray(16,32).toString("hex"))}catch{throw Error(Xf)}}function lf(f){return f.startsWith(y)&&!f.startsWith(c)}function h(f,g){if(!f.startsWith(y))return f;return f.startsWith(c)?zf(f,g):Vf(f,g)}function sf(f,g,B){return P(h(f,g),B)}function af(f){let g=f.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return g&&g[1]?g[1].toLowerCase():""}function v(f=""){return f?process.env[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}function q(f,g={}){let B={},A=[],$=[],_=f.split(`
2
+ import{createCipheriv as gf,createDecipheriv as Bf,createHash as r,createPrivateKey as xf,createPublicKey as $f,diffieHellman as Af,generateKeyPairSync as _f,hkdfSync as Xf,randomBytes as t}from"crypto";var y="x25519-public:",n="x25519-private:",P="encrypted:v2:",v="encrypted:",Df=Buffer.from("stacks-env:v2","utf8"),Hf="Environment decryption failed: authentication or format error";function Of(f){if(f.length===32)return f;return r("sha256").update(f).digest()}function sf(f,g){let B=t(16),A=gf("aes-256-gcm",Of(g),B);return{ciphertext:Buffer.concat([A.update(f,"utf8"),A.final()]).toString("hex"),iv:B.toString("hex"),authTag:A.getAuthTag().toString("hex")}}function Mf(f,g,B,A){try{let $=Bf("aes-256-gcm",Of(g),Buffer.from(B,"hex"));return $.setAuthTag(Buffer.from(A,"hex")),Buffer.concat([$.update(Buffer.from(f,"hex")),$.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function z(f){return f.toString("base64url")}function C(f,g,B){if(typeof f!=="string"||f.length>0&&!/^[A-Za-z0-9_-]+$/.test(f))throw Error(`${g} is not canonical base64url`);let A=Buffer.from(f,"base64url");if(z(A)!==f)throw Error(`${g} is not canonical base64url`);if(B!==void 0&&A.length!==B)throw Error(`${g} has an invalid length`);return A}function Ef(f){if(!f.startsWith(y))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let g=$f({key:C(f.slice(y.length),"public key"),format:"der",type:"spki"});if(g.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return g}function zf(f){if(!f.startsWith(n))throw Error("Private key is not a version 2 X25519 key");let g=xf({key:C(f.slice(n.length),"private key"),format:"der",type:"pkcs8"});if(g.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return g}function Rf(f){return Buffer.from(`stacks-env:v2;${f.epk};${f.salt};${f.nonce}`,"utf8")}function F(){let{publicKey:f,privateKey:g}=_f("x25519"),B=f.export({format:"der",type:"spki"}),A=g.export({format:"der",type:"pkcs8"});return{publicKey:`${y}${z(B)}`,privateKey:`${n}${z(A)}`}}function c(f,g){let B=Ef(g),A=_f("x25519"),$=z(A.publicKey.export({format:"der",type:"spki"})),_=t(16),D=t(12),O=Af({privateKey:A.privateKey,publicKey:B}),R=Buffer.from(Xf("sha256",O,_,Df,32)),X={epk:$,salt:z(_),nonce:z(D)};try{let H=gf("aes-256-gcm",R,D);H.setAAD(Rf(X));let W=Buffer.concat([H.update(f,"utf8"),H.final()]),G={v:2,...X,ciphertext:z(W),tag:z(H.getAuthTag())};return`${P}${z(Buffer.from(JSON.stringify(G),"utf8"))}`}finally{O.fill(0),R.fill(0)}}function Vf(f){let g=C(f.slice(P.length),"envelope").toString("utf8"),B=JSON.parse(g);if(!B||typeof B!=="object"||Array.isArray(B))throw Error("envelope is not an object");let A=Object.keys(B).sort(),$=["ciphertext","epk","nonce","salt","tag","v"];if(A.length!==$.length||A.some((_,D)=>_!==$[D]))throw Error("envelope fields are invalid");if(B.v!==2)throw Error("envelope version is unsupported");for(let _ of["epk","salt","nonce","ciphertext","tag"])if(typeof B[_]!=="string")throw Error(`${_} is invalid`);return B}function Cf(f,g){try{let B=Vf(f),A=zf(g),$=$f({key:C(B.epk,"ephemeral public key"),format:"der",type:"spki"});if($.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let _=C(B.salt,"salt",16),D=C(B.nonce,"nonce",12),O=C(B.ciphertext,"ciphertext"),R=C(B.tag,"tag",16),X=Af({privateKey:A,publicKey:$}),H=Buffer.from(Xf("sha256",X,_,Df,32));try{let W=Bf("aes-256-gcm",H,D);return W.setAAD(Rf(B)),W.setAuthTag(R),Buffer.concat([W.update(O),W.final()]).toString("utf8")}finally{X.fill(0),H.fill(0)}}catch{throw Error(Hf)}}function bf(f,g){try{if(!/^[0-9a-f]{64}$/.test(g))throw Error("invalid legacy private key");let B=Buffer.from(f.slice(v.length),"base64");if(B.length<32)throw Error("invalid legacy payload");let A=r("sha256").update(Buffer.from(g,"hex")).digest(),$=r("sha256").update(A).digest();return Mf(B.subarray(32).toString("hex"),$,B.subarray(0,16).toString("hex"),B.subarray(16,32).toString("hex"))}catch{throw Error(Hf)}}function af(f){return f.startsWith(v)&&!f.startsWith(P)}function h(f,g){if(!f.startsWith(v))return f;return f.startsWith(P)?Cf(f,g):bf(f,g)}function ef(f,g,B){return c(h(f,g),B)}function fg(f){let g=f.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return g&&g[1]?g[1].toLowerCase():""}function i(f=""){return f?process.env[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}function L(f,g={}){let B={},A=[],$=[],_=f.split(`
3
3
  `);for(let D of _){let O=D.trim();if(!O||O.startsWith("#"))continue;if(O.startsWith("DOTENV_PUBLIC_KEY=")){let W=O.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(W&&W[1]!==void 0)B.DOTENV_PUBLIC_KEY=W[1];continue}let R=O.match(/^([^=]+)=(.*)$/);if(!R||R[1]===void 0||R[2]===void 0)continue;let X=R[1].trim(),H=R[2].trim();if(H.startsWith('"')&&H.endsWith('"')||H.startsWith("'")&&H.endsWith("'")){if(H=H.slice(1,-1),H.includes("\\n"))H=H.replace(/\\n/g,`
4
- `)}if(H.startsWith("encrypted:")||H.startsWith("enc:")){if(!g.privateKey){$.push(X);continue}try{let W=H.startsWith("enc:")?`encrypted:${H.slice(4)}`:H;H=h(W,g.privateKey)}catch(W){A.push(`Failed to decrypt ${X}: ${W instanceof Error?W.message:"Unknown error"}`)}}H=Cf(H,{...g.processEnv||process.env,...B}),H=hf(H),B[X]=H}return{parsed:B,errors:A,skippedEncrypted:$}}function Cf(f,g){return f.replace(/\$\{([^}]+)\}/g,(B,A)=>{let $=A.match(/^([^:\-+]+)(:-|-)(.+)$/);if($){let[,D,O,R]=$,X=g[D];if(O===":-")return X||R;else return X!==void 0?X:R}let _=A.match(/^([^:\-+]+)(:?\+)(.+)$/);if(_){let[,D,O,R]=_,X=g[D];if(O===":+")return X?R:"";else return X!==void 0?R:""}return g[A]||""})}var bf=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function hf(f){return f.replace(/\$\(([^)]+)\)/g,(g,B)=>{try{let A=B.trim().split(/\s+/),$=A[0];if(!$||!bf.has($))return console.warn(`[env] Blocked command substitution for disallowed command: ${$}`),"";let _=Bun.spawnSync(A,{stdout:"pipe",stderr:"pipe"});if(_.exitCode===0)return new TextDecoder().decode(_.stdout).trim();console.warn(`[env] Command substitution failed (exit code ${_.exitCode}): ${$}`)}catch(A){console.warn(`[env] Command substitution error: ${A instanceof Error?A.message:String(A)}`)}return""})}async function gg(f,g={}){let B={},A=[],$=[];for(let _ of f)try{let D=Bun.file(_);if(!D.size)continue;let O=await D.text(),{parsed:R,errors:X,skippedEncrypted:H}=q(O,g);A.push(...X),$.push(...H);for(let[W,G]of Object.entries(R)){if(!g.overload&&B[W]!==void 0)continue;B[W]=G}}catch(D){if(D?.code==="ENOENT")continue;A.push(`Failed to read ${_}: ${D instanceof Error?D.message:String(D)}`)}return{parsed:B,errors:A,skippedEncrypted:$}}import{existsSync as m}from"fs";import{readFileSync as n}from"fs";import{resolve as k}from"path";function S(f){return typeof f==="string"&&(f.startsWith("encrypted:")||f.startsWith("enc:"))}function b(f){if(!f||S(f))return;let g=f.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(g))return;if(g==="prod")return"production";if(g==="stage")return"staging";if(g==="dev")return"development";return g}var i=null,o;function Ff(f,g,B=".env.keys"){let A=k(g,B);if(!m(A))return;try{let{parsed:$}=q(n(A,"utf-8"));if(f){let _=$[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`];if(_)return _}return $.DOTENV_PRIVATE_KEY}catch{return}}function Sf(f={}){let g=b(f.env)||b(process.env.APP_ENV)||b("development")||b(process.env.DOTENV_ENV)||"development",B=f.cwd||process.cwd();if(i===g)return o;let A=v(g);if(!A)A=process.env.DOTENV_PRIVATE_KEY;if(!A)A=Ff(g,B);return i=g,o=A,A}function Og(){i=null,o=void 0}function Of(f,g={}){if(!S(f))return f;let B=Sf(g);if(!B)return;try{let A=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;return h(A,B)}catch{return}}function Rf(f={}){let{path:g=[".env"],overload:B=!1,env:A,privateKey:$,keysFile:_=".env.keys",quiet:D=!1,cwd:O=process.cwd()}=f,R=Array.isArray(g)?g:[g],X=[],H=0,W=new Set(Object.entries(process.env).filter(([,T])=>T!==void 0&&!S(T)).map(([T])=>T)),G=$;if(!G&&_){let T=k(O,_);if(m(T))try{let Y=n(T,"utf-8"),{parsed:Z}=q(Y);if(A){let U=`DOTENV_PRIVATE_KEY_${A.toUpperCase()}`;G=Z[U]}else G=Z.DOTENV_PRIVATE_KEY}catch(Y){X.push(`Failed to load keys file: ${Y instanceof Error?Y.message:"Unknown error"}`)}}if(!G)G=v(A||"");for(let T of R){let Y=k(O,T);if(!m(Y)){if(!D)X.push(`File not found: ${Y}`);continue}try{let Z=n(Y,"utf-8"),{parsed:U,errors:I,skippedEncrypted:Q}=q(Z,{privateKey:G,processEnv:process.env});if(X.push(...I),Q.length>0){for(let K of Q)if(S(process.env[K]))delete process.env[K];let w=A?`DOTENV_PRIVATE_KEY_${A.toUpperCase()}`:"DOTENV_PRIVATE_KEY",V=Q.slice(0,5).join(", "),N=Q.length>5?`, \u2026 +${Q.length-5} more`:"";console.warn(`[env] warning: skipped ${Q.length} encrypted value(s) in ${T} (${w} not set; defaults apply): ${V}${N}`)}let J=0;for(let[w,V]of Object.entries(U)){if(w==="DOTENV_PUBLIC_KEY")continue;let N=process.env[w],K=S(N)&&V!==N;if(B||!W.has(w)||K)process.env[w]=V,H++,J++}if(!D&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${J}/${Object.keys(U).length} variables from ${T}`),process.env.__ENV_LOADED__="1"}catch(Z){X.push(`Failed to load ${Y}: ${Z instanceof Error?Z.message:"Unknown error"}`)}}return{loaded:H,errors:X}}function Nf(f={}){return{name:"env-plugin",setup(g){Rf(f)}}}function Rg(f={}){let g=b(f.env)||b("development")||b(process.env.DOTENV_ENV)||b(process.env.APP_ENV)||"development",B=f.cwd||process.cwd(),A=[],$=(O)=>{if(!A.includes(O)&&m(k(B,O)))A.push(O)};$(".env"),$(".env.local");let _=`.env.${g}`,D=`.env.${g}.local`;return $(_),$(D),Rf({...f,path:A,env:g})}var Tg=Nf;import{existsSync as x,readFileSync as L,renameSync as p,rmSync as Wf,writeFileSync as M}from"fs";import{basename as l,dirname as Tf,resolve as E}from"path";function Zg(f,g){if(f)return f;let B=String(g??"").trim();if(!B||B==="development"||B==="dev"||B==="local")return"";if(!/^[\w.-]+$/.test(B))return"";return`.env.${B}`}function Yf(f,g,B,A){let $=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${B}="${g}"`,""];for(let _ of f.split(`
5
- `)){let D=_.trim();if(!D||D.startsWith("#")){$.push(_);continue}if(D.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=D.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){$.push(_);continue}let R=O[1].trim(),X=O[2].trim();if(X.startsWith('"')&&X.endsWith('"')||X.startsWith("'")&&X.endsWith("'"))X=X.slice(1,-1);if((!A.key||R.includes(A.key))&&(!A.excludeKey||!R.includes(A.excludeKey))&&!X.startsWith("encrypted:"))X=P(X,g);$.push(`${R}="${X}"`)}return $.join(`
6
- `)}function Ig(f={}){let g=f.cwd||process.cwd(),B=E(g,f.file||".env"),A=E(g,f.keysFile||".env.keys");if(!x(B))return{success:!1,error:`File not found: ${B}`};try{let $,_;if(x(A)){let H=L(A,"utf-8"),{parsed:W}=q(H),Y=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Z=Y?`DOTENV_PUBLIC_KEY_${Y}`:"DOTENV_PUBLIC_KEY",U=Y?`DOTENV_PRIVATE_KEY_${Y}`:"DOTENV_PRIVATE_KEY";if($=W[Z]||"",_=W[U]||"",!$||!_){let I=F();$=I.publicKey,_=I.privateKey;let Q=`
4
+ `)}if(H.startsWith("encrypted:")||H.startsWith("enc:")){if(!g.privateKey){$.push(X);continue}try{let W=H.startsWith("enc:")?`encrypted:${H.slice(4)}`:H;H=h(W,g.privateKey)}catch(W){A.push(`Failed to decrypt ${X}: ${W instanceof Error?W.message:"Unknown error"}`)}}H=hf(H,{...g.processEnv||process.env,...B}),H=Sf(H),B[X]=H}return{parsed:B,errors:A,skippedEncrypted:$}}function hf(f,g){return f.replace(/\$\{([^}]+)\}/g,(B,A)=>{let $=A.match(/^([^:\-+]+)(:-|-)(.+)$/);if($){let[,D,O,R]=$,X=g[D];if(O===":-")return X||R;else return X!==void 0?X:R}let _=A.match(/^([^:\-+]+)(:?\+)(.+)$/);if(_){let[,D,O,R]=_,X=g[D];if(O===":+")return X?R:"";else return X!==void 0?R:""}return g[A]||""})}var Ff=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function Sf(f){return f.replace(/\$\(([^)]+)\)/g,(g,B)=>{try{let A=B.trim().split(/\s+/),$=A[0];if(!$||!Ff.has($))return console.warn(`[env] Blocked command substitution for disallowed command: ${$}`),"";let _=Bun.spawnSync(A,{stdout:"pipe",stderr:"pipe"});if(_.exitCode===0)return new TextDecoder().decode(_.stdout).trim();console.warn(`[env] Command substitution failed (exit code ${_.exitCode}): ${$}`)}catch(A){console.warn(`[env] Command substitution error: ${A instanceof Error?A.message:String(A)}`)}return""})}async function $g(f,g={}){let B={},A=[],$=[];for(let _ of f)try{let D=Bun.file(_);if(!D.size)continue;let O=await D.text(),{parsed:R,errors:X,skippedEncrypted:H}=L(O,g);A.push(...X),$.push(...H);for(let[W,G]of Object.entries(R)){if(!g.overload&&B[W]!==void 0)continue;B[W]=G}}catch(D){if(D?.code==="ENOENT")continue;A.push(`Failed to read ${_}: ${D instanceof Error?D.message:String(D)}`)}return{parsed:B,errors:A,skippedEncrypted:$}}import{existsSync as m}from"fs";import{readFileSync as o}from"fs";import{resolve as k}from"path";function S(f){return typeof f==="string"&&(f.startsWith("encrypted:")||f.startsWith("enc:"))}function b(f){if(!f||S(f))return;let g=f.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(g))return;if(g==="prod")return"production";if(g==="stage")return"staging";if(g==="dev")return"development";return g}var d=null,u,p;function Kf(f,g,B=".env.keys"){let A=k(g,B);if(!m(A))return;try{let{parsed:$}=L(o(A,"utf-8"));if(f){let _=$[`DOTENV_PRIVATE_KEY_${f.toUpperCase()}`];if(_)return _}return $.DOTENV_PRIVATE_KEY}catch{return}}function l(f={}){return b(f.env)||p||b("development")||b(process.env.DOTENV_ENV)||b(process.env.APP_ENV)||"development"}function Nf(f={}){let g=l(f),B=f.cwd||process.cwd();if(d===g)return u;let A=i(g);if(!A)A=process.env.DOTENV_PRIVATE_KEY;if(!A)A=Kf(g,B);return d=g,u=A,A}function Wg(){d=null,u=void 0}function Wf(f,g={}){if(!S(f))return f;let B=Nf(g);if(!B)return;try{let A=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;return h(A,B)}catch{return}}function Tf(f={}){let{path:g=[".env"],overload:B=!1,env:A,privateKey:$,keysFile:_=".env.keys",quiet:D=!1,cwd:O=process.cwd()}=f,R=Array.isArray(g)?g:[g],X=[],H=0,W=new Set(Object.entries(process.env).filter(([,T])=>T!==void 0&&!S(T)).map(([T])=>T)),G=$;if(!G&&_){let T=k(O,_);if(m(T))try{let Y=o(T,"utf-8"),{parsed:Z}=L(Y);if(A){let U=`DOTENV_PRIVATE_KEY_${A.toUpperCase()}`;G=Z[U]}else G=Z.DOTENV_PRIVATE_KEY}catch(Y){X.push(`Failed to load keys file: ${Y instanceof Error?Y.message:"Unknown error"}`)}}if(!G)G=i(A||"");for(let T of R){let Y=k(O,T);if(!m(Y)){if(!D)X.push(`File not found: ${Y}`);continue}try{let Z=o(Y,"utf-8"),{parsed:U,errors:I,skippedEncrypted:Q}=L(Z,{privateKey:G,processEnv:process.env});if(X.push(...I),Q.length>0){for(let N of Q)if(S(process.env[N]))delete process.env[N];let w=A?`DOTENV_PRIVATE_KEY_${A.toUpperCase()}`:"DOTENV_PRIVATE_KEY",V=Q.slice(0,5).join(", "),K=Q.length>5?`, \u2026 +${Q.length-5} more`:"";console.warn(`[env] warning: skipped ${Q.length} encrypted value(s) in ${T} (${w} not set; defaults apply): ${V}${K}`)}let J=0;for(let[w,V]of Object.entries(U)){if(w==="DOTENV_PUBLIC_KEY")continue;let K=process.env[w],N=S(K)&&V!==K;if(B||!W.has(w)||N)process.env[w]=V,H++,J++}if(!D&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${J}/${Object.keys(U).length} variables from ${T}`),process.env.__ENV_LOADED__="1"}catch(Z){X.push(`Failed to load ${Y}: ${Z instanceof Error?Z.message:"Unknown error"}`)}}return{loaded:H,errors:X}}function Pf(f={}){return{name:"env-plugin",setup(g){Tf(f)}}}function Tg(f={}){let g=b(f.env)||b("development")||b(process.env.DOTENV_ENV)||b(process.env.APP_ENV)||"development",B=f.cwd||process.cwd();if(p!==g)p=g,d=null,u=void 0;let A=[],$=(O)=>{if(!A.includes(O)&&m(k(B,O)))A.push(O)};$(".env"),$(".env.local");let _=`.env.${g}`,D=`.env.${g}.local`;return $(_),$(D),Tf({...f,path:A,env:g})}var jg=Pf;import{existsSync as M,readFileSync as x,renameSync as s,rmSync as Yf,writeFileSync as E}from"fs";import{basename as a,dirname as jf,resolve as q}from"path";function Qg(f,g){if(f)return f;let B=String(g??"").trim();if(!B||B==="development"||B==="dev"||B==="local")return"";if(!/^[\w.-]+$/.test(B))return"";return`.env.${B}`}function Gf(f,g,B,A){let $=["#/-------------------[DOTENV_PUBLIC_KEY]--------------------/","#/ versioned X25519 encryption for .env files /","#/ [how it works](https://stacksjs.com/encryption) /","#/----------------------------------------------------------/",`${B}="${g}"`,""];for(let _ of f.split(`
5
+ `)){let D=_.trim();if(!D||D.startsWith("#")){$.push(_);continue}if(D.startsWith("DOTENV_PUBLIC_KEY"))continue;let O=D.match(/^([^=]+)=(.*)$/);if(!O||O[1]===void 0||O[2]===void 0){$.push(_);continue}let R=O[1].trim(),X=O[2].trim();if(X.startsWith('"')&&X.endsWith('"')||X.startsWith("'")&&X.endsWith("'"))X=X.slice(1,-1);if((!A.key||R.includes(A.key))&&(!A.excludeKey||!R.includes(A.excludeKey))&&!X.startsWith("encrypted:"))X=c(X,g);$.push(`${R}="${X}"`)}return $.join(`
6
+ `)}function wg(f={}){let g=f.cwd||process.cwd(),B=q(g,f.file||".env"),A=q(g,f.keysFile||".env.keys");if(!M(B))return{success:!1,error:`File not found: ${B}`};try{let $,_;if(M(A)){let H=x(A,"utf-8"),{parsed:W}=L(H),Y=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Z=Y?`DOTENV_PUBLIC_KEY_${Y}`:"DOTENV_PUBLIC_KEY",U=Y?`DOTENV_PRIVATE_KEY_${Y}`:"DOTENV_PRIVATE_KEY";if($=W[Z]||"",_=W[U]||"",!$||!_){let I=F();$=I.publicKey,_=I.privateKey;let Q=`
7
7
  ${Z}="${$}"
8
8
  ${U}="${_}"
9
- `;M(A,H+Q,"utf-8")}}else{let H=F();$=H.publicKey,_=H.privateKey;let T=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=T?`DOTENV_PUBLIC_KEY_${T}`:"DOTENV_PUBLIC_KEY",Z=T?`DOTENV_PRIVATE_KEY_${T}`:"DOTENV_PRIVATE_KEY",U=`# .env.keys - Keep this file secure and never commit to source control
9
+ `;E(A,H+Q,"utf-8")}}else{let H=F();$=H.publicKey,_=H.privateKey;let T=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),Y=T?`DOTENV_PUBLIC_KEY_${T}`:"DOTENV_PUBLIC_KEY",Z=T?`DOTENV_PRIVATE_KEY_${T}`:"DOTENV_PRIVATE_KEY",U=`# .env.keys - Keep this file secure and never commit to source control
10
10
  ${Y}="${$}"
11
11
  ${Z}="${_}"
12
- `;M(A,U,"utf-8")}let D=L(B,"utf-8"),O=f.file?f.file.replace(/^\.env\./,"").toUpperCase():"",R=O?`DOTENV_PUBLIC_KEY_${O}`:"DOTENV_PUBLIC_KEY",X=Yf(D,$,R,f);if(f.stdout)return{success:!0,output:X};return M(B,X,"utf-8"),{success:!0,output:`\u2714 encrypted (${f.file||".env"})
13
- \u2714 key added to ${f.keysFile||".env.keys"}`}}catch($){return{success:!1,error:`Failed to encrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Kf(f={}){let g=f.cwd||process.cwd(),B=E(g,f.file||".env"),A=E(g,f.keysFile||".env.keys");if(!x(B))return{success:!1,error:`File not found: ${B}`};if(!x(A))return{success:!1,error:`Keys file not found: ${A}`};try{let $=L(A,"utf-8"),{parsed:_}=q($),R=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY",H=_[X];if(!H)return{success:!1,error:`Private key not found: ${X}`};let G=L(B,"utf-8").split(`
12
+ `;E(A,U,"utf-8")}let D=x(B,"utf-8"),O=f.file?f.file.replace(/^\.env\./,"").toUpperCase():"",R=O?`DOTENV_PUBLIC_KEY_${O}`:"DOTENV_PUBLIC_KEY",X=Gf(D,$,R,f);if(f.stdout)return{success:!0,output:X};return E(B,X,"utf-8"),{success:!0,output:`\u2714 encrypted (${f.file||".env"})
13
+ \u2714 key added to ${f.keysFile||".env.keys"}`}}catch($){return{success:!1,error:`Failed to encrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function cf(f={}){let g=f.cwd||process.cwd(),B=q(g,f.file||".env"),A=q(g,f.keysFile||".env.keys");if(!M(B))return{success:!1,error:`File not found: ${B}`};if(!M(A))return{success:!1,error:`Keys file not found: ${A}`};try{let $=x(A,"utf-8"),{parsed:_}=L($),R=((f.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY",H=_[X];if(!H)return{success:!1,error:`Private key not found: ${X}`};let G=x(B,"utf-8").split(`
14
14
  `),T=[];for(let Z of G){let U=Z.trim();if(!U||U.startsWith("#")){T.push(Z);continue}if(U.startsWith("DOTENV_PUBLIC_KEY"))continue;let I=U.match(/^([^=]+)=(.*)$/);if(!I||I[1]===void 0||I[2]===void 0){T.push(Z);continue}let Q=I[1].trim(),J=I[2].trim();if(J.startsWith('"')&&J.endsWith('"')||J.startsWith("'")&&J.endsWith("'"))J=J.slice(1,-1);let w=J.startsWith("encrypted:");if(f.key&&!Q.includes(f.key))w=!1;if(w)J=h(J,H);T.push(`${Q}="${J}"`)}let Y=T.join(`
15
- `);if(f.stdout)return{success:!0,output:Y};return M(B,Y,"utf-8"),{success:!0,output:`\u2714 decrypted (${f.file||".env"})`}}catch($){return{success:!1,error:`Failed to decrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Qg(f,g,B={}){let A=B.cwd||process.cwd(),$=E(A,B.file||".env"),_=E(A,B.keysFile||".env.keys");try{let D="";if(x($))D=L($,"utf-8");let O=D.split(`
16
- `),R=!1,X,G=((B.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),T=G?`DOTENV_PUBLIC_KEY_${G}`:"DOTENV_PUBLIC_KEY",Y=G?`DOTENV_PRIVATE_KEY_${G}`:"DOTENV_PRIVATE_KEY";for(let I of O){let Q=I.trim();if(Q.startsWith(`${T}=`)){let J=Q.match(/^[^=]+=["']?([^"'\n]+)["']?/);if(J)X=J[1];break}}if(X){let I=!1;if(x(_)){let Q=L(_,"utf-8"),{parsed:J}=q(Q);I=Boolean(J[Y])}if(!I)X=void 0}if(!B.plain&&!X){let I=F();X=I.publicKey;let Q="";if(x(_))Q=L(_,"utf-8");Q+=`
15
+ `);if(f.stdout)return{success:!0,output:Y};return E(B,Y,"utf-8"),{success:!0,output:`\u2714 decrypted (${f.file||".env"})`}}catch($){return{success:!1,error:`Failed to decrypt: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Ug(f,g,B={}){let A=B.cwd||process.cwd(),$=q(A,B.file||".env"),_=q(A,B.keysFile||".env.keys");try{let D="";if(M($))D=x($,"utf-8");let O=D.split(`
16
+ `),R=!1,X,G=((B.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),T=G?`DOTENV_PUBLIC_KEY_${G}`:"DOTENV_PUBLIC_KEY",Y=G?`DOTENV_PRIVATE_KEY_${G}`:"DOTENV_PRIVATE_KEY";for(let I of O){let Q=I.trim();if(Q.startsWith(`${T}=`)){let J=Q.match(/^[^=]+=["']?([^"'\n]+)["']?/);if(J)X=J[1];break}}if(X){let I=!1;if(M(_)){let Q=x(_,"utf-8"),{parsed:J}=L(Q);I=Boolean(J[Y])}if(!I)X=void 0}if(!B.plain&&!X){let I=F();X=I.publicKey;let Q="";if(M(_))Q=x(_,"utf-8");Q+=`
17
17
  ${T}="${I.publicKey}"
18
18
  ${Y}="${I.privateKey}"
19
- `,M(_,Q,"utf-8");for(let J=O.length-1;J>=0;J--){let w=O[J];if(w!==void 0&&w.trim().startsWith(`${T}=`))O.splice(J,1)}O.unshift(`${T}="${X}"`)}let Z=g;if(!B.plain&&X)Z=P(g,X);for(let I=0;I<O.length;I++){let Q=O[I];if(Q===void 0)continue;if(Q.trim().startsWith(`${f}=`)){O[I]=`${f}="${Z}"`,R=!0;break}}if(!R)O.push(`${f}="${Z}"`);let U=O.join(`
20
- `);return M($,U,"utf-8"),{success:!0,output:`set ${f}${B.plain?"":" with encryption"} (${B.file||".env"})`}}catch(D){return{success:!1,error:`Failed to set: ${D instanceof Error?D.message:"Unknown error"}`}}}function wg(f,g={}){let B=g.cwd||process.cwd(),A=E(B,g.file||".env");if(!x(A))return{success:!1,error:`File not found: ${A}`};try{let $,_=E(B,g.keysFile||".env.keys"),R=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY";if(x(_)){let Y=L(_,"utf-8"),{parsed:Z}=q(Y);$=Z[X]}if(!$)$=process.env[X];let H=L(A,"utf-8"),{parsed:W}=q(H,{privateKey:$});if(f&&!g.all){let Y=W[f];if(Y===void 0)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:Y}}let G=g.all?{...process.env,...W}:W,T;switch(g.format){case"shell":T=Object.entries(G).map(([Y,Z])=>`${Y}=${Z}`).join(" ");break;case"eval":T=Object.entries(G).map(([Y,Z])=>`${Y}="${Z}"`).join(`
21
- `);break;case"json":default:T=g.prettyPrint?JSON.stringify(G,null,2):JSON.stringify(G);break}return{success:!0,output:T}}catch($){return{success:!1,error:`Failed to get: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Ug(f,g={}){let B=g.cwd||process.cwd(),A=E(B,g.keysFile||".env.keys");if(!x(A))return{success:!1,error:`Keys file not found: ${A}`};try{let $=L(A,"utf-8"),{parsed:_}=q($),R=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PUBLIC_KEY_${R}`:"DOTENV_PUBLIC_KEY",H=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY";if(f){let T=_[f];if(!T)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:T}}let W={[X]:_[X],[H]:_[H]};return{success:!0,output:g.format==="shell"?`${X}=${W[X]} ${H}=${W[H]}`:JSON.stringify(W)}}catch($){return{success:!1,error:`Failed to get keypair: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Eg(f={}){let g=Kf({file:f.file,keysFile:f.keysFile,stdout:!0,cwd:f.cwd});if(!g.success)return g;let B=f.cwd||process.cwd(),A=E(B,f.file||".env"),$=E(B,f.keysFile||".env.keys");if(g.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let _=F(),D=L(A),O=L($),R=O.toString("utf8").split(`
22
- `),X=f.file||".env",H=l(X).replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),W=H?`DOTENV_PUBLIC_KEY_${H}`:"DOTENV_PUBLIC_KEY",G=H?`DOTENV_PRIVATE_KEY_${H}`:"DOTENV_PRIVATE_KEY",T=!1,Y=!1;for(let w=0;w<R.length;w++){let V=R[w];if(V===void 0)continue;if(V.startsWith(`${W}=`))R[w]=`${W}="${_.publicKey}"`,T=!0;else if(V.startsWith(`${G}=`))R[w]=`${G}="${_.privateKey}"`,Y=!0}if(!T)R.push(`${W}="${_.publicKey}"`);if(!Y)R.push(`${G}="${_.privateKey}"`);let Z=`${R.join(`
19
+ `,E(_,Q,"utf-8");for(let J=O.length-1;J>=0;J--){let w=O[J];if(w!==void 0&&w.trim().startsWith(`${T}=`))O.splice(J,1)}O.unshift(`${T}="${X}"`)}let Z=g;if(!B.plain&&X)Z=c(g,X);for(let I=0;I<O.length;I++){let Q=O[I];if(Q===void 0)continue;if(Q.trim().startsWith(`${f}=`)){O[I]=`${f}="${Z}"`,R=!0;break}}if(!R)O.push(`${f}="${Z}"`);let U=O.join(`
20
+ `);return E($,U,"utf-8"),{success:!0,output:`set ${f}${B.plain?"":" with encryption"} (${B.file||".env"})`}}catch(D){return{success:!1,error:`Failed to set: ${D instanceof Error?D.message:"Unknown error"}`}}}function qg(f,g={}){let B=g.cwd||process.cwd(),A=q(B,g.file||".env");if(!M(A))return{success:!1,error:`File not found: ${A}`};try{let $,_=q(B,g.keysFile||".env.keys"),R=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY";if(M(_)){let Y=x(_,"utf-8"),{parsed:Z}=L(Y);$=Z[X]}if(!$)$=process.env[X];let H=x(A,"utf-8"),{parsed:W}=L(H,{privateKey:$});if(f&&!g.all){let Y=W[f];if(Y===void 0)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:Y}}let G=g.all?{...process.env,...W}:W,T;switch(g.format){case"shell":T=Object.entries(G).map(([Y,Z])=>`${Y}=${Z}`).join(" ");break;case"eval":T=Object.entries(G).map(([Y,Z])=>`${Y}="${Z}"`).join(`
21
+ `);break;case"json":default:T=g.prettyPrint?JSON.stringify(G,null,2):JSON.stringify(G);break}return{success:!0,output:T}}catch($){return{success:!1,error:`Failed to get: ${$ instanceof Error?$.message:"Unknown error"}`}}}function Lg(f,g={}){let B=g.cwd||process.cwd(),A=q(B,g.keysFile||".env.keys");if(!M(A))return{success:!1,error:`Keys file not found: ${A}`};try{let $=x(A,"utf-8"),{parsed:_}=L($),R=((g.file||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),X=R?`DOTENV_PUBLIC_KEY_${R}`:"DOTENV_PUBLIC_KEY",H=R?`DOTENV_PRIVATE_KEY_${R}`:"DOTENV_PRIVATE_KEY";if(f){let T=_[f];if(!T)return{success:!1,error:`Key not found: ${f}`};return{success:!0,output:T}}let W={[X]:_[X],[H]:_[H]};return{success:!0,output:g.format==="shell"?`${X}=${W[X]} ${H}=${W[H]}`:JSON.stringify(W)}}catch($){return{success:!1,error:`Failed to get keypair: ${$ instanceof Error?$.message:"Unknown error"}`}}}function xg(f={}){let g=cf({file:f.file,keysFile:f.keysFile,stdout:!0,cwd:f.cwd});if(!g.success)return g;let B=f.cwd||process.cwd(),A=q(B,f.file||".env"),$=q(B,f.keysFile||".env.keys");if(g.output===void 0)return{success:!1,error:"Rotation produced no decrypted content"};let _=F(),D=x(A),O=x($),R=O.toString("utf8").split(`
22
+ `),X=f.file||".env",H=a(X).replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase(),W=H?`DOTENV_PUBLIC_KEY_${H}`:"DOTENV_PUBLIC_KEY",G=H?`DOTENV_PRIVATE_KEY_${H}`:"DOTENV_PRIVATE_KEY",T=!1,Y=!1;for(let w=0;w<R.length;w++){let V=R[w];if(V===void 0)continue;if(V.startsWith(`${W}=`))R[w]=`${W}="${_.publicKey}"`,T=!0;else if(V.startsWith(`${G}=`))R[w]=`${G}="${_.privateKey}"`,Y=!0}if(!T)R.push(`${W}="${_.publicKey}"`);if(!Y)R.push(`${G}="${_.privateKey}"`);let Z=`${R.join(`
23
23
  `).replace(/\n+$/,"")}
24
- `,U=Yf(g.output,_.publicKey,W,f),I=`${process.pid}-${Date.now()}`,Q=E(Tf(A),`.${l(A)}.${I}.rotate`),J=E(Tf($),`.${l($)}.${I}.rotate`);try{if(M(Q,U,{encoding:"utf8",mode:384}),M(J,Z,{encoding:"utf8",mode:384}),f.stdout)return p(J,$),{success:!0,output:U};p(Q,A);try{p(J,$)}catch(w){throw M(A,D),w}return{success:!0,output:`\u2714 rotated (${f.file||".env"}) to encrypted:v2`}}catch(w){if(!x($))M($,O,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${w instanceof Error?w.message:"Unknown error"}`}}finally{Wf(Q,{force:!0}),Wf(J,{force:!0})}}import j from"process";import{platform as cf}from"os";var jf=typeof Bun<"u",Gf=typeof j<"u"&&j.versions?.node!==void 0,Pf=jf?"bun":Gf?"node":"unknown",Mg={name:Pf,version:jf?Bun.version:Gf?j.version:void 0},a=cf(),zg=a==="win32",Vg=a==="darwin",Cg=a==="linux",Jf=Boolean(j.stdout?.isTTY),bg=typeof globalThis.window<"u",mf=Boolean(j.env.CI||j.env.CONTINUOUS_INTEGRATION||j.env.BUILD_NUMBER||j.env.RUN_ID),hg=Boolean(j.env.DEBUG||j.env.VERBOSE||j.argv.includes("--debug")||j.argv.includes("--verbose")),kf=mf||!Jf,Fg=Boolean(!kf&&(Jf||j.env.COLORTERM||j.env.FORCE_COLOR||j.env.TERM&&j.env.TERM!=="dumb")),s={github:{name:"GitHub Actions",detected:Boolean(j.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(j.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(j.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(j.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(j.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(j.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(j.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(j.env.DYNO)},aws:{name:"AWS",detected:Boolean(j.env.AWS_REGION||j.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(j.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(j.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(j.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(j.env.RENDER)}},df=Object.keys(s).find((f)=>{let g=s[f];return g!==void 0&&g.detected})||"unknown",Sg=s[df]||{name:"Unknown",detected:!1};import rf from"process";import{projectPath as tf}from"@stacksjs/path";import Qf from"fs";var Zf={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function If(f){return`${f.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function uf(f,g={}){let B=g.self?If(g.self):void 0,A=(g.tenants??[]).filter((D)=>typeof D==="string"&&D.trim().length>0).map((D)=>({slug:D,prefix:If(D)})).filter(({prefix:D})=>D!==B).sort((D,O)=>O.prefix.length-D.prefix.length),$={},_={};for(let[D,O]of Object.entries(f)){let R=A.find(({prefix:X})=>D.startsWith(X));if(R){(_[R.slug]??={})[D]=O;continue}$[D]=O}return{own:$,foreign:_}}function cg(f,g={}){return uf(f,g).own}function Pg(f){return Object.entries(f.foreign).map(([g,B])=>({tenant:g,keys:Object.keys(B).sort()})).sort((g,B)=>g.tenant.localeCompare(B.tenant))}var wf=new Set;function yf(f){if(wf.has(f))return;wf.add(f),console.warn(`[env] warning: "${f}" is encrypted but no usable private key was found to decrypt it; falling back to its default. Set DOTENV_PRIVATE_KEY_<ENV> or ship .env.keys.`)}var vf={get:(f,g)=>{let B=f[g];if(typeof B==="string"&&(B.startsWith("encrypted:")||B.startsWith("enc:"))){let $=Of(B);if($===void 0){yf(g),delete f[g];return}f[g]=$,B=$}let A=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof B==="string"&&/^\d+$/.test(B)&&!B.startsWith("0")&&A.some(($)=>g.endsWith($)))return Number(B);if(typeof B==="string"){let $=B.toLowerCase();if($==="true")return!0;if($==="false")return!1}return B}};function nf(){return typeof Bun<"u"?Bun.env:rf.env}var Uf=new Proxy(nf(),vf);function yg(f,g,B){let A=B?.path||tf(".env"),_=Qf.readFileSync(A,"utf-8").split(`
25
- `),D=_.findIndex((X)=>X.startsWith(`${f}=`)),R=/[\s"'#$\\]/.test(g)?`"${g.replace(/"/g,"\\\"")}"`:g;if(D!==-1)_[D]=`${f}=${R}`;else _.push(`${f}=${R}`);Qf.writeFileSync(A,_.join(`
26
- `))}function vg(f=Uf){let g=[];for(let[B,A]of Object.entries(Zf)){let $=f[B];if($!==void 0&&$!==""&&!A.includes(String($)))g.push(`${B}="${$}" is not valid. Allowed values: ${A.join(", ")}`)}return g}function ng(f,g=Uf){let B=[];for(let A of f){let $=g[A];if($===void 0||$===""||$===null)B.push(A)}if(B.length>0)throw Error(`[env] Missing required environment variable(s): ${B.join(", ")}. Set them in .env or your process environment before booting.`);return g}export{yg as writeEnv,vg as validateEnv,If as tenantEnvPrefix,cg as stripForeignTenantEnv,Qg as setEnv,Mg as runtimeInfo,Pf as runtime,Eg as rotateKeypair,Sf as resolvePrivateKey,Zg as resolveEnvFile,Og as resetPrivateKeyCache,ng as requireEnv,Sg as providerInfo,df as provider,nf as process,a as platform,uf as partitionTenantEnv,af as parseEnvFromKey,q as parse,sf as migrateEncryptedValue,gg as loadEnvFiles,Rf as loadEnv,zg as isWindows,Gf as isNode,kf as isMinimal,Vg as isMacOS,Cg as isLinux,lf as isLegacyEncryptedValue,hg as isDebug,Fg as isColorSupported,mf as isCI,jf as isBun,bg as hasWindow,Jf as hasTTY,v as getPrivateKey,Ug as getKeypair,wg as getEnv,F as generateKeypair,Pg as foreignTenantKeys,Nf as envPlugin,Zf as envEnum,Uf as env,P as encryptValue,Ig as encryptEnv,h as decryptValue,Of as decryptEnvValue,Kf as decryptEnv,Rg as autoLoadEnv,pf as aesEncrypt,qf as aesDecrypt};
24
+ `,U=Gf(g.output,_.publicKey,W,f),I=`${process.pid}-${Date.now()}`,Q=q(jf(A),`.${a(A)}.${I}.rotate`),J=q(jf($),`.${a($)}.${I}.rotate`);try{if(E(Q,U,{encoding:"utf8",mode:384}),E(J,Z,{encoding:"utf8",mode:384}),f.stdout)return s(J,$),{success:!0,output:U};s(Q,A);try{s(J,$)}catch(w){throw E(A,D),w}return{success:!0,output:`\u2714 rotated (${f.file||".env"}) to encrypted:v2`}}catch(w){if(!M($))E($,O,{mode:384});return{success:!1,error:`Failed to rotate without exposing plaintext: ${w instanceof Error?w.message:"Unknown error"}`}}finally{Yf(Q,{force:!0}),Yf(J,{force:!0})}}import j from"process";import{platform as mf}from"os";var Jf=typeof Bun<"u",Zf=typeof j<"u"&&j.versions?.node!==void 0,kf=Jf?"bun":Zf?"node":"unknown",Vg={name:kf,version:Jf?Bun.version:Zf?j.version:void 0},ff=mf(),Cg=ff==="win32",bg=ff==="darwin",hg=ff==="linux",If=Boolean(j.stdout?.isTTY),Fg=typeof globalThis.window<"u",df=Boolean(j.env.CI||j.env.CONTINUOUS_INTEGRATION||j.env.BUILD_NUMBER||j.env.RUN_ID),Sg=Boolean(j.env.DEBUG||j.env.VERBOSE||j.argv.includes("--debug")||j.argv.includes("--verbose")),uf=df||!If,Kg=Boolean(!uf&&(If||j.env.COLORTERM||j.env.FORCE_COLOR||j.env.TERM&&j.env.TERM!=="dumb")),e={github:{name:"GitHub Actions",detected:Boolean(j.env.GITHUB_ACTIONS)},gitlab:{name:"GitLab CI",detected:Boolean(j.env.GITLAB_CI)},circle:{name:"CircleCI",detected:Boolean(j.env.CIRCLECI)},travis:{name:"Travis CI",detected:Boolean(j.env.TRAVIS)},jenkins:{name:"Jenkins",detected:Boolean(j.env.JENKINS_URL)},vercel:{name:"Vercel",detected:Boolean(j.env.VERCEL)},netlify:{name:"Netlify",detected:Boolean(j.env.NETLIFY)},heroku:{name:"Heroku",detected:Boolean(j.env.DYNO)},aws:{name:"AWS",detected:Boolean(j.env.AWS_REGION||j.env.AWS_LAMBDA_FUNCTION_NAME)},azure:{name:"Azure",detected:Boolean(j.env.AZURE_HTTP_USER_AGENT)},cloudflare:{name:"Cloudflare",detected:Boolean(j.env.CF_PAGES)},railway:{name:"Railway",detected:Boolean(j.env.RAILWAY_ENVIRONMENT)},render:{name:"Render",detected:Boolean(j.env.RENDER)}},rf=Object.keys(e).find((f)=>{let g=e[f];return g!==void 0&&g.detected})||"unknown",Ng=e[rf]||{name:"Unknown",detected:!1};import yf from"process";import{projectPath as nf}from"@stacksjs/path";import Uf from"fs";var Qf={APP_ENV:["local","dev","development","staging","prod","production"],DB_CONNECTION:["mysql","sqlite","postgres","dynamodb"],DB_MIGRATE_FRESH:["allow","confirm","disabled"],MAIL_MAILER:["smtp","mailgun","ses","log","sendgrid","mailtrap"],SEARCH_ENGINE_DRIVER:["opensearch","meilisearch","algolia","typesense"],FRONTEND_APP_ENV:["development","staging","production"]};function wf(f){return`${f.replace(/[^a-z0-9]/gi,"").toUpperCase()}_`}function tf(f,g={}){let B=g.self?wf(g.self):void 0,A=(g.tenants??[]).filter((D)=>typeof D==="string"&&D.trim().length>0).map((D)=>({slug:D,prefix:wf(D)})).filter(({prefix:D})=>D!==B).sort((D,O)=>O.prefix.length-D.prefix.length),$={},_={};for(let[D,O]of Object.entries(f)){let R=A.find(({prefix:X})=>D.startsWith(X));if(R){(_[R.slug]??={})[D]=O;continue}$[D]=O}return{own:$,foreign:_}}function mg(f,g={}){return tf(f,g).own}function kg(f){return Object.entries(f.foreign).map(([g,B])=>({tenant:g,keys:Object.keys(B).sort()})).sort((g,B)=>g.tenant.localeCompare(B.tenant))}var qf=new Set;function vf(f){if(qf.has(f))return;qf.add(f);let g=l();console.warn(`[env] warning: "${f}" is encrypted but no usable private key was found for the "${g}" environment; falling back to its default. Set DOTENV_PRIVATE_KEY_${g.toUpperCase()} or ship .env.keys.`)}var of={get:(f,g)=>{let B=f[g];if(typeof B==="string"&&(B.startsWith("encrypted:")||B.startsWith("enc:"))){let $=Wf(B);if($===void 0){vf(g),delete f[g];return}f[g]=$,B=$}let A=["_PORT","_TIMEOUT","_TTL","_SIZE","_LIMIT","_MAX","_MIN","_INTERVAL","_RETRIES","_CONCURRENCY","_WORKERS","_CONNECTIONS"];if(typeof B==="string"&&/^\d+$/.test(B)&&!B.startsWith("0")&&A.some(($)=>g.endsWith($)))return Number(B);if(typeof B==="string"){let $=B.toLowerCase();if($==="true")return!0;if($==="false")return!1}return B}};function pf(){return typeof Bun<"u"?Bun.env:yf.env}var Lf=new Proxy(pf(),of);function vg(f,g,B){let A=B?.path||nf(".env"),_=Uf.readFileSync(A,"utf-8").split(`
25
+ `),D=_.findIndex((X)=>X.startsWith(`${f}=`)),R=/[\s"'#$\\]/.test(g)?`"${g.replace(/"/g,"\\\"")}"`:g;if(D!==-1)_[D]=`${f}=${R}`;else _.push(`${f}=${R}`);Uf.writeFileSync(A,_.join(`
26
+ `))}function ig(f=Lf){let g=[];for(let[B,A]of Object.entries(Qf)){let $=f[B];if($!==void 0&&$!==""&&!A.includes(String($)))g.push(`${B}="${$}" is not valid. Allowed values: ${A.join(", ")}`)}return g}function og(f,g=Lf){let B=[];for(let A of f){let $=g[A];if($===void 0||$===""||$===null)B.push(A)}if(B.length>0)throw Error(`[env] Missing required environment variable(s): ${B.join(", ")}. Set them in .env or your process environment before booting.`);return g}export{vg as writeEnv,ig as validateEnv,wf as tenantEnvPrefix,mg as stripForeignTenantEnv,Ug as setEnv,Vg as runtimeInfo,kf as runtime,xg as rotateKeypair,Nf as resolvePrivateKey,Qg as resolveEnvFile,Wg as resetPrivateKeyCache,og as requireEnv,Ng as providerInfo,rf as provider,pf as process,ff as platform,tf as partitionTenantEnv,fg as parseEnvFromKey,L as parse,ef as migrateEncryptedValue,$g as loadEnvFiles,Tf as loadEnv,Cg as isWindows,Zf as isNode,uf as isMinimal,bg as isMacOS,hg as isLinux,af as isLegacyEncryptedValue,Sg as isDebug,Kg as isColorSupported,df as isCI,Jf as isBun,Fg as hasWindow,If as hasTTY,i as getPrivateKey,Lg as getKeypair,qg as getEnv,F as generateKeypair,kg as foreignTenantKeys,Pf as envPlugin,Qf as envEnum,Lf as env,c as encryptValue,wg as encryptEnv,h as decryptValue,Wf as decryptEnvValue,cf as decryptEnv,Tg as autoLoadEnv,sf as aesEncrypt,Mf as aesDecrypt,l as activeEnvName};
package/dist/plugin.d.ts CHANGED
@@ -1,4 +1,10 @@
1
1
  import type { BunPlugin } from 'bun';
2
+ /**
3
+ * The environment the env layer is operating as.
4
+ *
5
+ * Exposed so a failure can say which key it went looking for.
6
+ */
7
+ export declare function activeEnvName(options?: { env?: string }): string;
2
8
  /**
3
9
  * Resolve the dotenvx private key for the active environment, checking
4
10
  * process.env (`DOTENV_PRIVATE_KEY_<ENV>` then `DOTENV_PRIVATE_KEY`) and
package/dist/plugin.js CHANGED
@@ -1,4 +1,4 @@
1
1
  // @bun
2
- import{createCipheriv as F,createDecipheriv as V,createHash as j,createPrivateKey as l,createPublicKey as M,diffieHellman as k,generateKeyPairSync as m,hkdfSync as P,randomBytes as C}from"crypto";var S="x25519-public:",G="x25519-private:",Y="encrypted:v2:",J="encrypted:",e=Buffer.from("stacks-env:v2","utf8"),z="Environment decryption failed: authentication or format error";function N(t){if(t.length===32)return t;return j("sha256").update(t).digest()}function xt(t,r){let c=C(16),n=F("aes-256-gcm",N(r),c);return{ciphertext:Buffer.concat([n.update(t,"utf8"),n.final()]).toString("hex"),iv:c.toString("hex"),authTag:n.getAuthTag().toString("hex")}}function tt(t,r,c,n){try{let i=V("aes-256-gcm",N(r),Buffer.from(c,"hex"));return i.setAuthTag(Buffer.from(n,"hex")),Buffer.concat([i.update(Buffer.from(t,"hex")),i.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function E(t){return t.toString("base64url")}function T(t,r,c){if(typeof t!=="string"||t.length>0&&!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`${r} is not canonical base64url`);let n=Buffer.from(t,"base64url");if(E(n)!==t)throw Error(`${r} is not canonical base64url`);if(c!==void 0&&n.length!==c)throw Error(`${r} has an invalid length`);return n}function rt(t){if(!t.startsWith(S))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let r=M({key:T(t.slice(S.length),"public key"),format:"der",type:"spki"});if(r.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return r}function nt(t){if(!t.startsWith(G))throw Error("Private key is not a version 2 X25519 key");let r=l({key:T(t.slice(G.length),"private key"),format:"der",type:"pkcs8"});if(r.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return r}function d(t){return Buffer.from(`stacks-env:v2;${t.epk};${t.salt};${t.nonce}`,"utf8")}function Et(){let{publicKey:t,privateKey:r}=m("x25519"),c=t.export({format:"der",type:"spki"}),n=r.export({format:"der",type:"pkcs8"});return{publicKey:`${S}${E(c)}`,privateKey:`${G}${E(n)}`}}function ct(t,r){let c=rt(r),n=m("x25519"),i=E(n.publicKey.export({format:"der",type:"spki"})),o=C(16),g=C(12),h=k({privateKey:n.privateKey,publicKey:c}),w=Buffer.from(P("sha256",h,o,e,32)),s={epk:i,salt:E(o),nonce:E(g)};try{let f=F("aes-256-gcm",w,g);f.setAAD(d(s));let b=Buffer.concat([f.update(t,"utf8"),f.final()]),u={v:2,...s,ciphertext:E(b),tag:E(f.getAuthTag())};return`${Y}${E(Buffer.from(JSON.stringify(u),"utf8"))}`}finally{h.fill(0),w.fill(0)}}function it(t){let r=T(t.slice(Y.length),"envelope").toString("utf8"),c=JSON.parse(r);if(!c||typeof c!=="object"||Array.isArray(c))throw Error("envelope is not an object");let n=Object.keys(c).sort(),i=["ciphertext","epk","nonce","salt","tag","v"];if(n.length!==i.length||n.some((o,g)=>o!==i[g]))throw Error("envelope fields are invalid");if(c.v!==2)throw Error("envelope version is unsupported");for(let o of["epk","salt","nonce","ciphertext","tag"])if(typeof c[o]!=="string")throw Error(`${o} is invalid`);return c}function ft(t,r){try{let c=it(t),n=nt(r),i=M({key:T(c.epk,"ephemeral public key"),format:"der",type:"spki"});if(i.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let o=T(c.salt,"salt",16),g=T(c.nonce,"nonce",12),h=T(c.ciphertext,"ciphertext"),w=T(c.tag,"tag",16),s=k({privateKey:n,publicKey:i}),f=Buffer.from(P("sha256",s,o,e,32));try{let b=V("aes-256-gcm",f,g);return b.setAAD(d(c)),b.setAuthTag(w),Buffer.concat([b.update(h),b.final()]).toString("utf8")}finally{s.fill(0),f.fill(0)}}catch{throw Error(z)}}function ot(t,r){try{if(!/^[0-9a-f]{64}$/.test(r))throw Error("invalid legacy private key");let c=Buffer.from(t.slice(J.length),"base64");if(c.length<32)throw Error("invalid legacy payload");let n=j("sha256").update(Buffer.from(r,"hex")).digest(),i=j("sha256").update(n).digest();return tt(c.subarray(32).toString("hex"),i,c.subarray(0,16).toString("hex"),c.subarray(16,32).toString("hex"))}catch{throw Error(z)}}function Tt(t){return t.startsWith(J)&&!t.startsWith(Y)}function _(t,r){if(!t.startsWith(J))return t;return t.startsWith(Y)?ft(t,r):ot(t,r)}function yt(t,r,c){return ct(_(t,r),c)}function $t(t){let r=t.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return r&&r[1]?r[1].toLowerCase():""}function L(t=""){return t?process.env[`DOTENV_PRIVATE_KEY_${t.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}function p(t,r={}){let c={},n=[],i=[],o=t.split(`
3
- `);for(let g of o){let h=g.trim();if(!h||h.startsWith("#"))continue;if(h.startsWith("DOTENV_PUBLIC_KEY=")){let b=h.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(b&&b[1]!==void 0)c.DOTENV_PUBLIC_KEY=b[1];continue}let w=h.match(/^([^=]+)=(.*)$/);if(!w||w[1]===void 0||w[2]===void 0)continue;let s=w[1].trim(),f=w[2].trim();if(f.startsWith('"')&&f.endsWith('"')||f.startsWith("'")&&f.endsWith("'")){if(f=f.slice(1,-1),f.includes("\\n"))f=f.replace(/\\n/g,`
4
- `)}if(f.startsWith("encrypted:")||f.startsWith("enc:")){if(!r.privateKey){i.push(s);continue}try{let b=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;f=_(b,r.privateKey)}catch(b){n.push(`Failed to decrypt ${s}: ${b instanceof Error?b.message:"Unknown error"}`)}}f=gt(f,{...r.processEnv||process.env,...c}),f=ht(f),c[s]=f}return{parsed:c,errors:n,skippedEncrypted:i}}function gt(t,r){return t.replace(/\$\{([^}]+)\}/g,(c,n)=>{let i=n.match(/^([^:\-+]+)(:-|-)(.+)$/);if(i){let[,g,h,w]=i,s=r[g];if(h===":-")return s||w;else return s!==void 0?s:w}let o=n.match(/^([^:\-+]+)(:?\+)(.+)$/);if(o){let[,g,h,w]=o,s=r[g];if(h===":+")return s?w:"";else return s!==void 0?w:""}return r[n]||""})}var st=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function ht(t){return t.replace(/\$\(([^)]+)\)/g,(r,c)=>{try{let n=c.trim().split(/\s+/),i=n[0];if(!i||!st.has(i))return console.warn(`[env] Blocked command substitution for disallowed command: ${i}`),"";let o=Bun.spawnSync(n,{stdout:"pipe",stderr:"pipe"});if(o.exitCode===0)return new TextDecoder().decode(o.stdout).trim();console.warn(`[env] Command substitution failed (exit code ${o.exitCode}): ${i}`)}catch(n){console.warn(`[env] Command substitution error: ${n instanceof Error?n.message:String(n)}`)}return""})}async function _t(t,r={}){let c={},n=[],i=[];for(let o of t)try{let g=Bun.file(o);if(!g.size)continue;let h=await g.text(),{parsed:w,errors:s,skippedEncrypted:f}=p(h,r);n.push(...s),i.push(...f);for(let[b,u]of Object.entries(w)){if(!r.overload&&c[b]!==void 0)continue;c[b]=u}}catch(g){if(g?.code==="ENOENT")continue;n.push(`Failed to read ${o}: ${g instanceof Error?g.message:String(g)}`)}return{parsed:c,errors:n,skippedEncrypted:i}}import{existsSync as H}from"fs";import{readFileSync as U}from"fs";import{resolve as W}from"path";function K(t){return typeof t==="string"&&(t.startsWith("encrypted:")||t.startsWith("enc:"))}function y(t){if(!t||K(t))return;let r=t.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(r))return;if(r==="prod")return"production";if(r==="stage")return"staging";if(r==="dev")return"development";return r}var Z=null,Q;function wt(t,r,c=".env.keys"){let n=W(r,c);if(!H(n))return;try{let{parsed:i}=p(U(n,"utf-8"));if(t){let o=i[`DOTENV_PRIVATE_KEY_${t.toUpperCase()}`];if(o)return o}return i.DOTENV_PRIVATE_KEY}catch{return}}function bt(t={}){let r=y(t.env)||y(process.env.APP_ENV)||y("development")||y(process.env.DOTENV_ENV)||"development",c=t.cwd||process.cwd();if(Z===r)return Q;let n=L(r);if(!n)n=process.env.DOTENV_PRIVATE_KEY;if(!n)n=wt(r,c);return Z=r,Q=n,n}function Ht(){Z=null,Q=void 0}function Wt(t,r={}){if(!K(t))return t;let c=bt(r);if(!c)return;try{let n=t.startsWith("enc:")?`encrypted:${t.slice(4)}`:t;return _(n,c)}catch{return}}function a(t={}){let{path:r=[".env"],overload:c=!1,env:n,privateKey:i,keysFile:o=".env.keys",quiet:g=!1,cwd:h=process.cwd()}=t,w=Array.isArray(r)?r:[r],s=[],f=0,b=new Set(Object.entries(process.env).filter(([,B])=>B!==void 0&&!K(B)).map(([B])=>B)),u=i;if(!u&&o){let B=W(h,o);if(H(B))try{let x=U(B,"utf-8"),{parsed:$}=p(x);if(n){let D=`DOTENV_PRIVATE_KEY_${n.toUpperCase()}`;u=$[D]}else u=$.DOTENV_PRIVATE_KEY}catch(x){s.push(`Failed to load keys file: ${x instanceof Error?x.message:"Unknown error"}`)}}if(!u)u=L(n||"");for(let B of w){let x=W(h,B);if(!H(x)){if(!g)s.push(`File not found: ${x}`);continue}try{let $=U(x,"utf-8"),{parsed:D,errors:v,skippedEncrypted:A}=p($,{privateKey:u,processEnv:process.env});if(s.push(...v),A.length>0){for(let O of A)if(K(process.env[O]))delete process.env[O];let R=n?`DOTENV_PRIVATE_KEY_${n.toUpperCase()}`:"DOTENV_PRIVATE_KEY",X=A.slice(0,5).join(", "),I=A.length>5?`, \u2026 +${A.length-5} more`:"";console.warn(`[env] warning: skipped ${A.length} encrypted value(s) in ${B} (${R} not set; defaults apply): ${X}${I}`)}let q=0;for(let[R,X]of Object.entries(D)){if(R==="DOTENV_PUBLIC_KEY")continue;let I=process.env[R],O=K(I)&&X!==I;if(c||!b.has(R)||O)process.env[R]=X,f++,q++}if(!g&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${q}/${Object.keys(D).length} variables from ${B}`),process.env.__ENV_LOADED__="1"}catch($){s.push(`Failed to load ${x}: ${$ instanceof Error?$.message:"Unknown error"}`)}}return{loaded:f,errors:s}}function Bt(t={}){return{name:"env-plugin",setup(r){a(t)}}}function jt(t={}){let r=y(t.env)||y("development")||y(process.env.DOTENV_ENV)||y(process.env.APP_ENV)||"development",c=t.cwd||process.cwd(),n=[],i=(h)=>{if(!n.includes(h)&&H(W(c,h)))n.push(h)};i(".env"),i(".env.local");let o=`.env.${r}`,g=`.env.${r}.local`;return i(o),i(g),a({...t,path:n,env:r})}var St=Bt;export{bt as resolvePrivateKey,Ht as resetPrivateKeyCache,a as loadEnv,Bt as envPlugin,St as default,Wt as decryptEnvValue,jt as autoLoadEnv};
2
+ import{createCipheriv as V,createDecipheriv as M,createHash as S,createPrivateKey as tt,createPublicKey as k,diffieHellman as P,generateKeyPairSync as m,hkdfSync as z,randomBytes as G}from"crypto";var J="x25519-public:",L="x25519-private:",Y="encrypted:v2:",U="encrypted:",N=Buffer.from("stacks-env:v2","utf8"),e="Environment decryption failed: authentication or format error";function d(t){if(t.length===32)return t;return S("sha256").update(t).digest()}function $t(t,r){let c=G(16),n=V("aes-256-gcm",d(r),c);return{ciphertext:Buffer.concat([n.update(t,"utf8"),n.final()]).toString("hex"),iv:c.toString("hex"),authTag:n.getAuthTag().toString("hex")}}function rt(t,r,c,n){try{let f=M("aes-256-gcm",d(r),Buffer.from(c,"hex"));return f.setAuthTag(Buffer.from(n,"hex")),Buffer.concat([f.update(Buffer.from(t,"hex")),f.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function T(t){return t.toString("base64url")}function $(t,r,c){if(typeof t!=="string"||t.length>0&&!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`${r} is not canonical base64url`);let n=Buffer.from(t,"base64url");if(T(n)!==t)throw Error(`${r} is not canonical base64url`);if(c!==void 0&&n.length!==c)throw Error(`${r} has an invalid length`);return n}function nt(t){if(!t.startsWith(J))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let r=k({key:$(t.slice(J.length),"public key"),format:"der",type:"spki"});if(r.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return r}function ct(t){if(!t.startsWith(L))throw Error("Private key is not a version 2 X25519 key");let r=tt({key:$(t.slice(L.length),"private key"),format:"der",type:"pkcs8"});if(r.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return r}function a(t){return Buffer.from(`stacks-env:v2;${t.epk};${t.salt};${t.nonce}`,"utf8")}function At(){let{publicKey:t,privateKey:r}=m("x25519"),c=t.export({format:"der",type:"spki"}),n=r.export({format:"der",type:"pkcs8"});return{publicKey:`${J}${T(c)}`,privateKey:`${L}${T(n)}`}}function ft(t,r){let c=nt(r),n=m("x25519"),f=T(n.publicKey.export({format:"der",type:"spki"})),g=G(16),o=G(12),h=P({privateKey:n.privateKey,publicKey:c}),w=Buffer.from(z("sha256",h,g,N,32)),s={epk:f,salt:T(g),nonce:T(o)};try{let i=V("aes-256-gcm",w,o);i.setAAD(a(s));let b=Buffer.concat([i.update(t,"utf8"),i.final()]),u={v:2,...s,ciphertext:T(b),tag:T(i.getAuthTag())};return`${Y}${T(Buffer.from(JSON.stringify(u),"utf8"))}`}finally{h.fill(0),w.fill(0)}}function it(t){let r=$(t.slice(Y.length),"envelope").toString("utf8"),c=JSON.parse(r);if(!c||typeof c!=="object"||Array.isArray(c))throw Error("envelope is not an object");let n=Object.keys(c).sort(),f=["ciphertext","epk","nonce","salt","tag","v"];if(n.length!==f.length||n.some((g,o)=>g!==f[o]))throw Error("envelope fields are invalid");if(c.v!==2)throw Error("envelope version is unsupported");for(let g of["epk","salt","nonce","ciphertext","tag"])if(typeof c[g]!=="string")throw Error(`${g} is invalid`);return c}function gt(t,r){try{let c=it(t),n=ct(r),f=k({key:$(c.epk,"ephemeral public key"),format:"der",type:"spki"});if(f.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let g=$(c.salt,"salt",16),o=$(c.nonce,"nonce",12),h=$(c.ciphertext,"ciphertext"),w=$(c.tag,"tag",16),s=P({privateKey:n,publicKey:f}),i=Buffer.from(z("sha256",s,g,N,32));try{let b=M("aes-256-gcm",i,o);return b.setAAD(a(c)),b.setAuthTag(w),Buffer.concat([b.update(h),b.final()]).toString("utf8")}finally{s.fill(0),i.fill(0)}}catch{throw Error(e)}}function ot(t,r){try{if(!/^[0-9a-f]{64}$/.test(r))throw Error("invalid legacy private key");let c=Buffer.from(t.slice(U.length),"base64");if(c.length<32)throw Error("invalid legacy payload");let n=S("sha256").update(Buffer.from(r,"hex")).digest(),f=S("sha256").update(n).digest();return rt(c.subarray(32).toString("hex"),f,c.subarray(0,16).toString("hex"),c.subarray(16,32).toString("hex"))}catch{throw Error(e)}}function yt(t){return t.startsWith(U)&&!t.startsWith(Y)}function E(t,r){if(!t.startsWith(U))return t;return t.startsWith(Y)?gt(t,r):ot(t,r)}function Rt(t,r,c){return ft(E(t,r),c)}function _t(t){let r=t.match(/^DOTENV_PRIVATE_KEY_(.+)$/);return r&&r[1]?r[1].toLowerCase():""}function Z(t=""){return t?process.env[`DOTENV_PRIVATE_KEY_${t.toUpperCase()}`]:process.env.DOTENV_PRIVATE_KEY}function p(t,r={}){let c={},n=[],f=[],g=t.split(`
3
+ `);for(let o of g){let h=o.trim();if(!h||h.startsWith("#"))continue;if(h.startsWith("DOTENV_PUBLIC_KEY=")){let b=h.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(b&&b[1]!==void 0)c.DOTENV_PUBLIC_KEY=b[1];continue}let w=h.match(/^([^=]+)=(.*)$/);if(!w||w[1]===void 0||w[2]===void 0)continue;let s=w[1].trim(),i=w[2].trim();if(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'")){if(i=i.slice(1,-1),i.includes("\\n"))i=i.replace(/\\n/g,`
4
+ `)}if(i.startsWith("encrypted:")||i.startsWith("enc:")){if(!r.privateKey){f.push(s);continue}try{let b=i.startsWith("enc:")?`encrypted:${i.slice(4)}`:i;i=E(b,r.privateKey)}catch(b){n.push(`Failed to decrypt ${s}: ${b instanceof Error?b.message:"Unknown error"}`)}}i=st(i,{...r.processEnv||process.env,...c}),i=wt(i),c[s]=i}return{parsed:c,errors:n,skippedEncrypted:f}}function st(t,r){return t.replace(/\$\{([^}]+)\}/g,(c,n)=>{let f=n.match(/^([^:\-+]+)(:-|-)(.+)$/);if(f){let[,o,h,w]=f,s=r[o];if(h===":-")return s||w;else return s!==void 0?s:w}let g=n.match(/^([^:\-+]+)(:?\+)(.+)$/);if(g){let[,o,h,w]=g,s=r[o];if(h===":+")return s?w:"";else return s!==void 0?w:""}return r[n]||""})}var ht=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function wt(t){return t.replace(/\$\(([^)]+)\)/g,(r,c)=>{try{let n=c.trim().split(/\s+/),f=n[0];if(!f||!ht.has(f))return console.warn(`[env] Blocked command substitution for disallowed command: ${f}`),"";let g=Bun.spawnSync(n,{stdout:"pipe",stderr:"pipe"});if(g.exitCode===0)return new TextDecoder().decode(g.stdout).trim();console.warn(`[env] Command substitution failed (exit code ${g.exitCode}): ${f}`)}catch(n){console.warn(`[env] Command substitution error: ${n instanceof Error?n.message:String(n)}`)}return""})}async function Kt(t,r={}){let c={},n=[],f=[];for(let g of t)try{let o=Bun.file(g);if(!o.size)continue;let h=await o.text(),{parsed:w,errors:s,skippedEncrypted:i}=p(h,r);n.push(...s),f.push(...i);for(let[b,u]of Object.entries(w)){if(!r.overload&&c[b]!==void 0)continue;c[b]=u}}catch(o){if(o?.code==="ENOENT")continue;n.push(`Failed to read ${g}: ${o instanceof Error?o.message:String(o)}`)}return{parsed:c,errors:n,skippedEncrypted:f}}import{existsSync as H}from"fs";import{readFileSync as Q}from"fs";import{resolve as W}from"path";function K(t){return typeof t==="string"&&(t.startsWith("encrypted:")||t.startsWith("enc:"))}function A(t){if(!t||K(t))return;let r=t.trim().toLowerCase();if(!/^[a-z0-9_-]+$/.test(r))return;if(r==="prod")return"production";if(r==="stage")return"staging";if(r==="dev")return"development";return r}var j=null,C,q;function bt(t,r,c=".env.keys"){let n=W(r,c);if(!H(n))return;try{let{parsed:f}=p(Q(n,"utf-8"));if(t){let g=f[`DOTENV_PRIVATE_KEY_${t.toUpperCase()}`];if(g)return g}return f.DOTENV_PRIVATE_KEY}catch{return}}function Bt(t={}){return A(t.env)||q||A("development")||A(process.env.DOTENV_ENV)||A(process.env.APP_ENV)||"development"}function ut(t={}){let r=Bt(t),c=t.cwd||process.cwd();if(j===r)return C;let n=Z(r);if(!n)n=process.env.DOTENV_PRIVATE_KEY;if(!n)n=bt(r,c);return j=r,C=n,n}function jt(){j=null,C=void 0}function Ct(t,r={}){if(!K(t))return t;let c=ut(r);if(!c)return;try{let n=t.startsWith("enc:")?`encrypted:${t.slice(4)}`:t;return E(n,c)}catch{return}}function l(t={}){let{path:r=[".env"],overload:c=!1,env:n,privateKey:f,keysFile:g=".env.keys",quiet:o=!1,cwd:h=process.cwd()}=t,w=Array.isArray(r)?r:[r],s=[],i=0,b=new Set(Object.entries(process.env).filter(([,B])=>B!==void 0&&!K(B)).map(([B])=>B)),u=f;if(!u&&g){let B=W(h,g);if(H(B))try{let x=Q(B,"utf-8"),{parsed:y}=p(x);if(n){let D=`DOTENV_PRIVATE_KEY_${n.toUpperCase()}`;u=y[D]}else u=y.DOTENV_PRIVATE_KEY}catch(x){s.push(`Failed to load keys file: ${x instanceof Error?x.message:"Unknown error"}`)}}if(!u)u=Z(n||"");for(let B of w){let x=W(h,B);if(!H(x)){if(!o)s.push(`File not found: ${x}`);continue}try{let y=Q(x,"utf-8"),{parsed:D,errors:v,skippedEncrypted:R}=p(y,{privateKey:u,processEnv:process.env});if(s.push(...v),R.length>0){for(let O of R)if(K(process.env[O]))delete process.env[O];let _=n?`DOTENV_PRIVATE_KEY_${n.toUpperCase()}`:"DOTENV_PRIVATE_KEY",X=R.slice(0,5).join(", "),I=R.length>5?`, \u2026 +${R.length-5} more`:"";console.warn(`[env] warning: skipped ${R.length} encrypted value(s) in ${B} (${_} not set; defaults apply): ${X}${I}`)}let F=0;for(let[_,X]of Object.entries(D)){if(_==="DOTENV_PUBLIC_KEY")continue;let I=process.env[_],O=K(I)&&X!==I;if(c||!b.has(_)||O)process.env[_]=X,i++,F++}if(!o&&!process.env.__ENV_LOADED__)console.error(`[env] loaded ${F}/${Object.keys(D).length} variables from ${B}`),process.env.__ENV_LOADED__="1"}catch(y){s.push(`Failed to load ${x}: ${y instanceof Error?y.message:"Unknown error"}`)}}return{loaded:i,errors:s}}function xt(t={}){return{name:"env-plugin",setup(r){l(t)}}}function St(t={}){let r=A(t.env)||A("development")||A(process.env.DOTENV_ENV)||A(process.env.APP_ENV)||"development",c=t.cwd||process.cwd();if(q!==r)q=r,j=null,C=void 0;let n=[],f=(h)=>{if(!n.includes(h)&&H(W(c,h)))n.push(h)};f(".env"),f(".env.local");let g=`.env.${r}`,o=`.env.${r}.local`;return f(g),f(o),l({...t,path:n,env:r})}var Jt=xt;export{ut as resolvePrivateKey,jt as resetPrivateKeyCache,l as loadEnv,xt as envPlugin,Jt as default,Ct as decryptEnvValue,St as autoLoadEnv,Bt as activeEnvName};
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "@stacksjs/env",
3
3
  "type": "module",
4
4
  "sideEffects": false,
5
- "version": "0.70.187",
5
+ "version": "0.70.189",
6
6
  "description": "Stacks env helper methods.",
7
7
  "author": "Chris Breuer",
8
8
  "contributors": [
@@ -51,7 +51,7 @@
51
51
  },
52
52
  "devDependencies": {
53
53
  "better-dx": "^0.2.17",
54
- "@stacksjs/path": "0.70.187",
55
- "@stacksjs/validation": "0.70.187"
54
+ "@stacksjs/path": "0.70.189",
55
+ "@stacksjs/validation": "0.70.189"
56
56
  }
57
57
  }